This page was not yet optimized for use on mobile devices.

Panorama 10.2 M-200, M-300, M-600 and M-700

Certificate details

Certificate ID	#5367
Status	active
Validation dates	06.07.2026
Sunset date	22-08-2029
Standard	FIPS 140-3
Security level	2
Type	Hardware
Embodiment	MultiChipStand
Caveat	When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and physical kit installed as indicated in the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs
Exceptions	Roles, services, and authentication: Level 3 Operational environment: N/A Non-invasive security: N/A Life-cycle assurance: Level 3 Mitigation of other attacks: N/A
Description	The Panorama 10.2 running on M-200, M-300, M-600 and M-700 from Palo Alto Networks Inc., hereafter referred to as "Panorama M-Series", "Panorama HW", "modules", or the "cryptographic modules" are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall.
Vendor	Palo Alto Networks Inc. http://www.paloaltonetworks.com
Lab	Leidos Accredited Testing & Evaluation (AT&E) Lab
Algorithms	AES-CBCA2906 AES-CFB128A2906 AES-CTRA2906 AES-GCMA2906 Counter DRBGA2906 ECDSA KeyGen (FIPS186-4)A2906 ECDSA KeyVer (FIPS186-4)A2906 ECDSA SigGen (FIPS186-4)A2906 ECDSA SigVer (FIPS186-4)A2906 HMAC-SHA-1A2906 HMAC-SHA2-224A2906 HMAC-SHA2-256A2906 HMAC-SHA2-384A2906 HMAC-SHA2-512A2906 KAS-ECC-SSC Sp800-56Ar3A2906 KAS-FFC-SSC Sp800-56Ar3A2906 KDF SNMPA2906 KDF SSHA2906 KDF TLSA2906 RSA KeyGen (FIPS186-4)A2906 RSA SigGen (FIPS186-4)A2906 RSA SigVer (FIPS186-4)A2906 Safe Primes Key GenerationA2906 Safe Primes Key VerificationA2906 SHA-1A2906 SHA2-224A2906 SHA2-256A2906 SHA2-384A2906 SHA2-512A2906
References	This certificate's webpage directly references 0 certificates, transitively this expands into 0 certificates.

Certificate

Webpage

Security policy

Security policy PDF TXT

Extracted keywords

Symmetric Algorithms

AES-256, AES-128, AES-192, AES, AES-, CAST, HMAC

Asymmetric Algorithms

RSA 2048, RSA 3072, RSA 4096, ECDH, ECDHE, ECDSA, ECC, DH, Diffie-Hellman, DHE

Hash functions

SHA-1, SHA-256

Schemes

MAC, Key Agreement

Protocols

SSH, SSHv2, TLS, TLSv1.2, TLS 1.2

Randomness

DRBG, RBG

Elliptic Curves

P-256, P-384, P-521

Block cipher modes

ECB, CBC, CTR, CFB, GCM

TLS cipher suites

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Trusted Execution Environments

PSP, SSC

Security level

level 2, Level 2

Certification process

out of scope, in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation

Standards

FIPS 140-3, FIPS186-4, FIPS 186-4, FIPS 198-1, FIPS 180-4, FIPS 186-2, FIPS18, FIPS186, SP 800-38A, SP 800-38D, SP 800-90A, SP 800-56A, SP 800-135, SP 800-90B, PKCS 1, RFC 5288, RFC 5246

Creation date	D:20260706103113-04'00'
Modification date	D:20260706103113-04'00'
Pages	82
Creator	Microsoft® Word for Microsoft 365
Producer	Microsoft® Word for Microsoft 365

Automated analysis

Automated inference - use with caution

All attributes shown in this section (e.g., links between certificates, products, vendors, and known CVEs) are generated by automated heuristics and have not been reviewed by humans. These methods can produce false positives or false negatives and should not be treated as definitive without independent verification. This applies equally to the Cross-references section below. If you want to know more about how this data is computed and how reliable it is, see our documentation on automated analysis. If you believe any information here is inaccurate or harmful, please submit feedback.

No automatically derived data are available in this section.

Cross-references

No references are available for this certificate.

Processing updates

06.10.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__insert__': {'Level 2': 1}}}}, 'fips_certlike': {'__update__': {'Certlike': {'__insert__': {'HMAC-SHA- 160': 1, 'HMAC-SHA- 160, 256': 1}, '__update__': {'SHA2- 256': 2, 'RSA 2048': 11}}}}, 'asymmetric_crypto': {'__update__': {'RSA': {'__update__': {'RSA 2048': 11}}}}, 'certification_process': {'__update__': {'OutOfScope': {'__insert__': {'in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation': 1}, '__delete__': ['in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. ### 11.2 Administrator Guidance The Administrator Guidance can be obtained from']}}}} data.
05.10.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__delete__': ['Level 2']}}}, 'fips_certlike': {'__update__': {'Certlike': {'__update__': {'SHA2- 256': 1, 'RSA 2048': 10}, '__delete__': ['HMAC-SHA- 160', 'HMAC-SHA- 160, 256']}}}, 'asymmetric_crypto': {'__update__': {'RSA': {'__update__': {'RSA 2048': 10}}}}, 'certification_process': {'__update__': {'OutOfScope': {'__insert__': {'in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. ### 11.2 Administrator Guidance The Administrator Guidance can be obtained from': 1}, '__delete__': ['in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation']}}}} data.
24.09.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__insert__': {'Level 2': 1}}}}, 'fips_certlike': {'__update__': {'Certlike': {'__insert__': {'HMAC-SHA- 160': 1, 'HMAC-SHA- 160, 256': 1}, '__update__': {'SHA2- 256': 2, 'RSA 2048': 11}}}}, 'asymmetric_crypto': {'__update__': {'RSA': {'__update__': {'RSA 2048': 11}}}}, 'certification_process': {'__update__': {'OutOfScope': {'__insert__': {'in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation': 1}, '__delete__': ['in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. ### 11.2 Administrator Guidance The Administrator Guidance can be obtained from']}}}} data.

The is_br1_format property was set to True.

The br1_tables property was set to {'_type': 'sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables', 'security_levels': {'section': 1, 'subsection': 2, 'found': True, 'entries': [{'section': '1', 'title': 'General', 'level': '2'}, {'section': '2', 'title': 'Cryptographic module specification', 'level': '2'}, {'section': '3', 'title': 'Cryptographic module interfaces', 'level': '2'}, {'section': '4', 'title': 'Roles, services, and authentication', 'level': '3'}, {'section': '5', 'title': 'Software/Firmware security', 'level': '2'}, {'section': '6', 'title': 'Operational environment', 'level': 'N/A'}, {'section': '7', 'title': 'Physical security', 'level': '2'}, {'section': '8', 'title': 'Non-invasive security', 'level': 'N/A'}, {'section': '9', 'title': 'Sensitive security parameter management', 'level': '2'}, {'section': '10', 'title': 'Self-tests', 'level': '2'}, {'section': '11', 'title': 'Life-cycle assurance', 'level': '3'}, {'section': '12', 'title': 'Mitigation of other attacks', 'level': 'N/A'}, {'section': '', 'title': 'Overall Level', 'level': '2'}]}, 'tested_module_id_hw': {'section': 2, 'subsection': 2, 'found': True, 'entries': [{'modelPartNum': 'Panorama M-200', 'hwVersion': '910-000176 with 920-000208', 'fwVersion': '10.2.3-h1', 'processors': 'Intel Xeon E5- 2620 V4', 'features': 'RJ45 interfaces, USB ports, LEDs'}, {'modelPartNum': 'Panorama M-300', 'hwVersion': '910-000271 with 920-000319', 'fwVersion': '10.2.3-h1', 'processors': 'Intel Xeon (Silver) 4310', 'features': 'RJ45 interfaces, USB ports, LEDs'}, {'modelPartNum': 'Panorama M-600', 'hwVersion': '910-000175 with 920-000209', 'fwVersion': '10.2.3-h1', 'processors': 'Intel Xeon E5- 2680 V4', 'features': 'RJ45 interfaces, USB ports, LEDs, SFP+ ports'}, {'modelPartNum': 'Panorama M-700', 'hwVersion': '910-000270 with 920-000318', 'fwVersion': '10.2.3-h1', 'processors': 'Intel Xeon (Silver) 4316', 'features': 'RJ45 interfaces, USB ports, LEDs, SFP+ ports'}]}, 'tested_module_id_sw_fw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'tested_module_id_hw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'tested_op_env_sw_fw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'vendor_affirmed_op_env_sw_fw_hy': {'section': 2, 'subsection': 2, 'found': False, 'entries': []}, 'modes_of_operation': {'section': 2, 'subsection': 4, 'found': True, 'entries': [{'name': 'Approved Mode', 'description': 'The module has one approved mode of operation and is always in approved mode after initialization', 'type': 'Approved', 'statusIndicator': 'Global indicator ("FIPS-CC")'}]}, 'approved_algorithms': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'algorithm': 'AES-CBC', 'cavpCertName': 'A2906', 'properties': 'Direction - Decrypt, Encrypt Key Length - 128, 192, 256', 'reference': 'SP 800-38A'}, {'algorithm': 'AES-CFB128', 'cavpCertName': 'A2906', 'properties': 'Direction - Decrypt, Encrypt Key Length - 128', 'reference': 'SP 800-38A'}, {'algorithm': 'AES-CTR', 'cavpCertName': 'A2906', 'properties': 'Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - No Counter Tests Performed - No', 'reference': 'SP 800-38A'}, {'algorithm': 'AES-GCM', 'cavpCertName': 'A2906', 'properties': 'Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 256', 'reference': 'SP 800-38D'}, {'algorithm': 'Counter DRBG', 'cavpCertName': 'A2906', 'properties': 'Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 0-384', 'reference': 'SP 800-90A Rev. 1'}, {'algorithm': '', 'cavpCertName': '', 'properties': 'Increment 8 Entropy Input - Entropy Input: 256-384 Increment 8, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128 Personalization String Length - Personalization String Length: 0-384 Increment 8 Returned Bits - 512', 'reference': ''}, {'algorithm': 'ECDSA KeyGen (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates', 'reference': 'FIPS 186-4'}, {'algorithm': 'ECDSA KeyVer (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Curve - P-256, P-384, P-521', 'reference': 'FIPS 186-4'}, {'algorithm': 'ECDSA SigGen (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512', 'reference': 'FIPS 186-4'}, {'algorithm': 'ECDSA SigVer (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Curve - P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512', 'reference': 'FIPS 186-4'}, {'algorithm': 'HMAC-SHA-1', 'cavpCertName': 'A2906', 'properties': 'MAC - MAC: 160 Key Length - Key Length: 256-2048 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2- 224', 'cavpCertName': 'A2906', 'properties': 'MAC - MAC: 224 Key Length - Key Length: 256-2048 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2- 256', 'cavpCertName': 'A2906', 'properties': 'MAC - MAC: 256 Key Length - Key Length: 256-2048 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2- 384', 'cavpCertName': 'A2906', 'properties': 'MAC - MAC: 384 Key Length - Key Length: 256-2048 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'HMAC-SHA2- 512', 'cavpCertName': 'A2906', 'properties': 'MAC - MAC: 512 Key Length - Key Length: 256-2048 Increment 8', 'reference': 'FIPS 198-1'}, {'algorithm': 'KAS-ECC-SSC Sp800-56Ar3', 'cavpCertName': 'A2906', 'properties': 'Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'KAS-FFC-SSC Sp800-56Ar3', 'cavpCertName': 'A2906', 'properties': 'Domain Parameter Generation Methods - MODP- 2048 Scheme - dhEphem - KAS Role - initiator, responder', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'KDF SNMP (CVL)', 'cavpCertName': 'A2906', 'properties': 'Password Length - Password Length: 64, 2048 Engine ID - 80001F88043030303030343935323630', 'reference': 'SP 800-135 Rev. 1'}, {'algorithm': 'KDF SSH (CVL)', 'cavpCertName': 'A2906', 'properties': 'Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-512', 'reference': 'SP 800-135 Rev. 1'}, {'algorithm': 'KDF TLS (CVL)', 'cavpCertName': 'A2906', 'properties': 'TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384', 'reference': 'SP 800-135 Rev. 1'}, {'algorithm': 'RSA KeyGen (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Key Generation Mode - B.3.6 Modulo - 2048, 3072, 4096', 'reference': 'FIPS 186-4'}, {'algorithm': '', 'cavpCertName': '', 'properties': 'Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard', 'reference': ''}, {'algorithm': 'RSA SigGen (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096', 'reference': 'FIPS 186-4'}, {'algorithm': 'RSA SigVer (FIPS186-4)', 'cavpCertName': 'A2906', 'properties': 'Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096', 'reference': 'FIPS 186-4'}, {'algorithm': 'Safe Primes Key Generation', 'cavpCertName': 'A2906', 'properties': 'Safe Prime Groups - MODP-2048', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'Safe Primes Key Verification', 'cavpCertName': 'A2906', 'properties': 'Safe Prime Groups - MODP-2048', 'reference': 'SP 800-56A Rev. 3'}, {'algorithm': 'SHA-1', 'cavpCertName': 'A2906', 'properties': 'Message Length - Message Length: 8-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-224', 'cavpCertName': 'A2906', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-256', 'cavpCertName': 'A2906', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-384', 'cavpCertName': 'A2906', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}, {'algorithm': 'SHA2-512', 'cavpCertName': 'A2906', 'properties': 'Message Length - Message Length: 0-65536 Increment 8', 'reference': 'FIPS 180-4'}]}, 'vendor_affirmed_algos': {'section': 2, 'subsection': 5, 'found': True, 'entries': [{'name': 'CKG', 'algoPropList': 'Key Type:Asymmetric', 'implName': 'N/A', 'reference': 'Cryptographic Key Generation; SP 800- 133rev2 and IG D.H (symmetric keys and asymmetric seeds) from Section 4 Example 1'}]}, 'non_approved_allowed_algos': {'section': 2, 'subsection': 5, 'found': False, 'entries': []}, 'non_approved_allowed_NSC': {'section': 2, 'subsection': 5, 'found': False, 'entries': []}, 'non_approved_not_allowed': {'section': 2, 'subsection': 5, 'found': False, 'entries': []}, 'ports_interfaces': {'section': 3, 'subsection': 1, 'found': True, 'entries': [{'physicalPort': 'LED', 'logicalInterface': 'Status Output', 'data': 'Module status via LED indicators'}, {'physicalPort': 'Power', 'logicalInterface': 'Power', 'data': 'N/A'}, {'physicalPort': 'RJ45 Console', 'logicalInterface': 'Status Output', 'data': 'Self-test output'}, {'physicalPort': 'RJ45 Ethernet', 'logicalInterface': 'Data Input Data Output Control Input Status Output', 'data': 'TLS, SSH'}, {'physicalPort': 'SFP+ (M-600, M-700)', 'logicalInterface': 'Data Input Data Output Control Input Status Output', 'data': 'TLS'}]}, 'authentication_methods': {'section': 4, 'subsection': 1, 'found': True, 'entries': [{'name': 'RSA- Based Certificate', 'description': 'The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits.', 'mechanism': 'Single-Factor Cryptographic Software.', 'strength': 'With a minimum modulus size of 2048, the probability that a random attempt will', 'perMinute': 'The probability of successfully authenticating to the module within a one minute period is 288,000,000/(2^112). The module supports at most 4,800,000 new sessions per second.'}, {'name': '', 'description': '', 'mechanism': '', 'strength': 'succeed is 1/(2^112).', 'perMinute': ''}, {'name': 'ECDSA- Based Certificate', 'description': 'The modules support ECDSA public- key based authentication mechanism using a minimum ECDSA curve of P-256.', 'mechanism': 'Single-Factor Cryptographic Software.', 'strength': 'With a minimum curve of P- 256, the probability that a random attempt will succeed is 1/(2^128).', 'perMinute': 'The probability of successfully authenticating to the module within a one minute period is 288,000,000/(2^112). The module supports at most 4,800,000 new sessions per second.'}, {'name': 'Password', 'description': 'Password based authentication', 'mechanism': 'Memorized Secret (Unique Username/password).', 'strength': 'The minimum length is eight (8) characters (95 possible characters). The probability that a random attempt will succeed or a false acceptance will occur is 1/(958).', 'perMinute': "The probability of successfully authenticating to the module within one minute is 10/(95^8). The firewall's configuration supports at most ten failed attempts to authenticate in a one- minute period."}]}, 'roles': {'section': 4, 'subsection': 2, 'found': True, 'entries': [{'name': 'Crypto Officer', 'type': 'Identity', 'operatorType': 'CO', 'authMethodList': 'RSA-Based Certificate ECDSA-Based Certificate Password'}, {'name': 'User', 'type': 'Identity', 'operatorType': 'User', 'authMethodList': 'RSA-Based Certificate ECDSA-Based Certificate Password'}]}, 'approved_services': {'section': 4, 'subsection': 3, 'found': False, 'entries': []}, 'non_approved_services': {'section': 4, 'subsection': 4, 'found': False, 'entries': []}, 'mechanisms_actions': {'section': 7, 'subsection': 1, 'found': True, 'entries': [{'mechanism': 'Tamper-Evident Seals', 'inspectFreq': '30 days', 'inspectGuidance': '(M-200, M-300) Verify integrity of tamper-evident seals in the locations identified in Section 7 of this Security Policy.'}, {'mechanism': 'Front and Rear Opacity Shields Side Rails', 'inspectFreq': '30 days', 'inspectGuidance': '(M-200, M-300) Verify that opacity shields and side rails have not been loosened or deformed from their original shape, thereby reducing their effectiveness.'}, {'mechanism': 'Top Overlays', 'inspectFreq': '30 days', 'inspectGuidance': '(M-200, M-300) Verify top overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics.'}, {'mechanism': 'Tamper Evident Seals', 'inspectFreq': '30 days', 'inspectGuidance': '(M-600, M-700) Verify integrity of tamper-evident seals in the locations specified in Section 7 of this Security Policy.'}, {'mechanism': 'Front and Rear Opacity Shields', 'inspectFreq': '30 days', 'inspectGuidance': '(M-600, M-700) Verify that the front and rear opacity shields have not been deformed from their original shape, thereby reducing their effectiveness'}, {'mechanism': 'Vent Overlays', 'inspectFreq': '30 days', 'inspectGuidance': '(M-600, M-700) Verify that the vent overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics'}]}, 'storage_areas': {'section': 9, 'subsection': 1, 'found': True, 'entries': [{'name': 'HDD', 'description': 'Non-Volatile Memory', 'persistance': 'Static'}, {'name': 'RAM', 'description': 'Volatile Memory', 'persistance': 'Dynamic'}]}, 'ssp_io_methods': {'section': 9, 'subsection': 2, 'found': True, 'entries': [{'name': 'Module Public Key Output', 'source': 'HDD', 'dest': "External (outside of module's boundary )", 'format': 'Plaintext', 'distribution': 'Automated', 'entry': 'Electroni c', 'sfiAlgo': ''}, {'name': 'Password/Secre t Input via SSHv2 encrypted by AES and HMAC', 'source': "External (outside of module's boundary )", 'dest': 'HDD', 'format': 'Encrypte d', 'distribution': 'Automated', 'entry': 'Electroni c', 'sfiAlgo': 'KTS (SSHv2 with AES and HMAC)'}, {'name': 'Password/Secre t Input via SSHv2 encrypted by AES-GCM', 'source': "External (outside of module's boundary )", 'dest': 'HDD', 'format': 'Encrypte d', 'distribution': 'Automated', 'entry': 'Electroni c', 'sfiAlgo': 'KTS (SSHv2 with AES- GCM)'}, {'name': 'Password/Secre t Input via TLSv1.2 encrypted by AES and HMAC', 'source': "External (outside of module's boundary )", 'dest': 'HDD', 'format': 'Encrypte d', 'distribution': 'Automated', 'entry': 'Electroni c', 'sfiAlgo': 'KTS (TLSv1.2 with AES and HMAC)'}, {'name': 'Password/Secre t Input via TLSv1.2 encrypted by AES-GCM', 'source': "External (outside of module's boundary )", 'dest': 'HDD', 'format': 'Encrypte d', 'distribution': 'Automated', 'entry': 'Electroni c', 'sfiAlgo': 'KTS (TLSv1.2 with AES- GCM)'}, {'name': 'Peer Public Key Input', 'source': "External (outside of module's boundary )", 'dest': 'HDD', 'format': 'Plaintext', 'distribution': 'Automated', 'entry': 'Electroni c', 'sfiAlgo': ''}]}, 'ssp_zeroization_methods': {'section': 9, 'subsection': 3, 'found': True, 'entries': [{'method': 'Power Cycle/Session Termination', 'description': 'Operator powers the module off or session terminates', 'rationale': 'Powering off the module or terminating the session will', 'operatorId': 'Command via CLI or WebUI or by unplugging module'}, {'method': '', 'description': '', 'rationale': 'erase all SSPs stored in the RAM of the module.', 'operatorId': ''}, {'method': 'Zeroization Command', 'description': 'CO issues zeroization service', 'rationale': 'The zeroization command will erase all SSPs stored in the RAM or in the Flash of the module.', 'operatorId': 'Entering into maintenance mode and selecting Factory Reset'}]}, 'self_tests': {'section': 10, 'subsection': 1, 'found': True, 'entries': [{'algorithmOrTest': 'ECDSA SigVer (FIPS186-4) (A2906)', 'testProps': 'P-256', 'testMethod': 'KAT', 'type': 'SW/FW Integrity', 'indicator': 'Self-Test successful', 'details': 'Signature Verification'}, {'algorithmOrTest': 'HMAC-SHA2-256 (A2906)', 'testProps': 'SHA2-256', 'testMethod': 'KAT', 'type': 'SW/FW Integrity', 'indicator': 'Self-Test successful', 'details': 'Keyed Checksum'}]}, 'cond_self_tests': {'section': 10, 'subsection': 2, 'found': True, 'entries': [{'algorithmOrTest': 'AES- ECB', 'testProps': '128 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output', 'details': 'Decrypt', 'condition': 'After each power-on or via'}, {'algorithmOrTest': 'Decrypt (A2906)', 'testProps': '', 'testMethod': '', 'type': '', 'indicator': 'messag e', 'details': '', 'condition': 'self-test command'}, {'algorithmOrTest': 'AES- GCM Decrypt (A2906)', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Decrypt', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'AES- GCM Encrypt (A2906)', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Encrypt', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'Counter DRBG (A2906)', 'testProps': 'N/A', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'SP 800-90Arev1 Instantiate/Generate/Res eed Known Answer Tests', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'ECDSA / KAS- ECC', 'testProps': '256 Bit Minimum', 'testMethod': 'PCT', 'type': 'PCT', 'indicator': 'System log messag es', 'details': 'ECDSA / KAS-ECC pairwise consistency test', 'condition': 'On session'}, {'algorithmOrTest': 'ECDSA SigGen (FIPS186 -4) (A2906)', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Sign', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'ECDSA SigVer (FIPS186 -4) (A2906)', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Verify', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'Firmware Load Test', 'testProps': '2048 Bit', 'testMethod': 'FW Load Test', 'type': 'SW/F W Load', 'indicator': 'System log messag es', 'details': 'Firmware load test on content load', 'condition': 'On session'}, {'algorithmOrTest': 'HMAC- SHA-1 (A2906)', 'testProps': '160 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Keyed Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'HMAC- SHA2- 224 (A2906)', 'testProps': '224 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Keyed Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'HMAC- SHA2-', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output', 'details': 'Keyed Hash', 'condition': 'After each power-on'}, {'algorithmOrTest': '256 (A2906)', 'testProps': '', 'testMethod': '', 'type': '', 'indicator': 'messag e', 'details': '', 'condition': 'or via self-test command'}, {'algorithmOrTest': 'HMAC- SHA2- 384 (A2906)', 'testProps': '384 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Keyed Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'HMAC- SHA2- 512 (A2906)', 'testProps': '512 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Keyed Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'KAS- ECC- SSC Sp800- 56Ar3 (A2906)', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'KAS Computation', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'Safe Primes Key Generati on (A2906)', 'testProps': '2048 Bits Minimum', 'testMethod': 'PCT', 'type': 'PCT', 'indicator': 'System log messag es', 'details': 'KAS-FCC pairwise consistency test', 'condition': 'On session'}, {'algorithmOrTest': 'KAS- FFC-SSC Sp800- 56Ar3 (A2906)', 'testProps': '2048 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'KAS Computation', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'RSA', 'testProps': '2048 Bits Minimum', 'testMethod': 'PCT', 'type': 'PCT', 'indicator': 'System log messag es', 'details': 'RSA pairwise consistency test', 'condition': 'On session'}, {'algorithmOrTest': 'RSA SigGen (FIPS186 -4) (A2906)', 'testProps': '2048 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Sign', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'RSA SigVer (FIPS186 -4) (A2906)', 'testProps': '2048 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Verify', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SHA-1 (A2906)', 'testProps': '160 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output', 'details': 'Hash', 'condition': 'After each power-on or via'}, {'algorithmOrTest': '', 'testProps': '', 'testMethod': '', 'type': '', 'indicator': 'messag e', 'details': '', 'condition': 'self-test command'}, {'algorithmOrTest': 'SHA2- 256 (A2906)', 'testProps': '256 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SHA2- 384 (A2906)', 'testProps': '384 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SHA2- 512 (A2906)', 'testProps': '512 Bits', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Hash', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SP 800- 90B RCT/APT Health Tests on Entropy Source', 'testProps': 'N/A', 'testMethod': 'Fault- Detectio n', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'Health tests done on entropy source', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SP 800- 135rev1 SSH KDF with SHA-256', 'testProps': 'N/A', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'SSHv2 with SHA-256', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SP 800- 135rev1 TLS 1.2 with SHA-256 KDF', 'testProps': 'N/A', 'testMethod': 'KAT', 'type': 'CAST', 'indicator': 'Self-test output messag e', 'details': 'TLSv1.2 with SHA-256', 'condition': 'After each power-on or via self-test command'}, {'algorithmOrTest': 'SP 800- 56A Rev 3 Assuranc e Tests', 'testProps': 'N/A', 'testMethod': 'Critical Functio ns', 'type': 'Critical Functio n', 'indicator': 'System log messag es', 'details': 'Assurance tests for SP 800-56A Rev3', 'condition': 'On session'}]}, 'error_states': {'section': 10, 'subsection': 4, 'found': True, 'entries': [{'name': 'Conditional Firmware Load Test Failure', 'description': 'Signature verification fails on firmware load', 'conditions': 'Signature verification failure', 'recoveryMethod': 'N/A', 'indicator': 'System prints Invalid image message.'}, {'name': 'Conditional Pairwise Consistency or Critical Functions Test Failure', 'description': 'Module fails a PCT or critical functions test', 'conditions': 'PCT / Critical functions test', 'recoveryMethod': 'Reset session', 'indicator': 'System log prints an error message.'}, {'name': 'Self-Test / Integrity Test Failure', 'description': 'Module fails a self-test or integrity test', 'conditions': 'Self-test or Integrity Test failure', 'recoveryMethod': 'Reboot Module or Factory Reset', 'indicator': 'FIPS-CC mode failure. <Algorithm test> failed.'}]}}.
23.09.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The following values were inserted: {'is_br1_format': False, 'br1_deviations': 0, 'br1_tables': None}.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__delete__': ['Level 2']}}}, 'fips_certlike': {'__update__': {'Certlike': {'__update__': {'SHA2- 256': 1, 'RSA 2048': 10}, '__delete__': ['HMAC-SHA- 160', 'HMAC-SHA- 160, 256']}}}, 'asymmetric_crypto': {'__update__': {'RSA': {'__update__': {'RSA 2048': 10}}}}, 'certification_process': {'__update__': {'OutOfScope': {'__insert__': {'in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. ### 11.2 Administrator Guidance The Administrator Guidance can be obtained from': 1}, '__delete__': ['in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation']}}}} data.
21.09.2026

The certificate data changed.
Certificate changed

The PDF extraction data was updated.

The following values were inserted: {'module_algorithms': {'_type': 'Set', 'elements': ['HMAC-SHA-1A2906', 'KAS-FFC-SSC Sp800-56Ar3A2906', 'AES-CFB128A2906', 'ECDSA SigVer (FIPS186-4)A2906', 'HMAC-SHA2-256A2906', 'KAS-ECC-SSC Sp800-56Ar3A2906', 'RSA KeyGen (FIPS186-4)A2906', 'HMAC-SHA2-384A2906', 'HMAC-SHA2-224A2906', 'HMAC-SHA2-512A2906', 'AES-GCMA2906', 'ECDSA KeyGen (FIPS186-4)A2906', 'SHA2-512A2906', 'SHA-1A2906', 'ECDSA SigGen (FIPS186-4)A2906', 'SHA2-256A2906', 'KDF TLSA2906', 'KDF SSHA2906', 'SHA2-384A2906', 'AES-CBCA2906', 'SHA2-224A2906', 'RSA SigGen (FIPS186-4)A2906', 'Safe Primes Key GenerationA2906', 'AES-CTRA2906', 'KDF SNMPA2906', 'Counter DRBGA2906', 'RSA SigVer (FIPS186-4)A2906', 'Safe Primes Key VerificationA2906', 'ECDSA KeyVer (FIPS186-4)A2906']}, 'policy_algorithms': {'_type': 'Set', 'elements': ['#A2906']}}.

The keywords property was updated, with the {'fips_security_level': {'__update__': {'Level': {'__delete__': ['Level 1', 'Level 8']}}}, 'certification_process': {'__update__': {'OutOfScope': {'__insert__': {'in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation': 1}, '__delete__': ['in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. 11.2 Administrator Guidance The Administrator Guidance can be obtained from']}}}} data.

The computed heuristics were updated.

The algorithms property was updated, with the {'_type': 'Set', 'elements': ['#A2906']} values added.

The state was updated.

The policy property was updated, with the {'txt_hash': '259b5f23deb0e0e80efe0d2a798b40571ac056a5210089e3a9d7626a1b4790c1', 'json_hash': 'dd805b73a5d661e28f862ad17dbcef94e938a426318ee56b12c47e37443dc64b'} data.
31.08.2026

The certificate data changed.
Certificate changed

The computed heuristics were updated.

The algorithms property was set to {'_type': 'Set', 'elements': ['HMAC-SHA-1A2906', 'KAS-FFC-SSC Sp800-56Ar3A2906', 'AES-CFB128A2906', 'HMAC-SHA2-256A2906', 'ECDSA SigVer (FIPS186-4)A2906', 'KAS-ECC-SSC Sp800-56Ar3A2906', 'RSA KeyGen (FIPS186-4)A2906', 'HMAC-SHA2-512A2906', 'HMAC-SHA2-224A2906', 'HMAC-SHA2-384A2906', 'AES-GCMA2906', 'ECDSA KeyGen (FIPS186-4)A2906', 'SHA-1A2906', 'SHA2-512A2906', 'ECDSA SigGen (FIPS186-4)A2906', 'SHA2-256A2906', 'KDF TLSA2906', 'KDF SSHA2906', 'SHA2-384A2906', 'AES-CBCA2906', 'SHA2-224A2906', 'RSA SigGen (FIPS186-4)A2906', 'Safe Primes Key GenerationA2906', 'AES-CTRA2906', 'KDF SNMPA2906', 'Counter DRBGA2906', 'RSA SigVer (FIPS186-4)A2906', 'Safe Primes Key VerificationA2906', 'ECDSA KeyVer (FIPS186-4)A2906']}.
17.08.2026

The certificate data changed.
Certificate changed

The web extraction data was updated.

The certificate_pdf_url property was set to https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf.
06.07.2026

The certificate was first processed.

Raw data

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5367,
  "dgst": "eac627facfe5f552",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "HMAC-SHA2-256A2906",
        "ECDSA KeyVer (FIPS186-4)A2906",
        "AES-GCMA2906",
        "HMAC-SHA2-384A2906",
        "Counter DRBGA2906",
        "AES-CBCA2906",
        "KDF SNMPA2906",
        "ECDSA KeyGen (FIPS186-4)A2906",
        "KDF TLSA2906",
        "SHA-1A2906",
        "#A2906",
        "RSA SigGen (FIPS186-4)A2906",
        "AES-CFB128A2906",
        "ECDSA SigGen (FIPS186-4)A2906",
        "HMAC-SHA-1A2906",
        "HMAC-SHA2-224A2906",
        "SHA2-512A2906",
        "SHA2-256A2906",
        "KAS-ECC-SSC Sp800-56Ar3A2906",
        "KDF SSHA2906",
        "KAS-FFC-SSC Sp800-56Ar3A2906",
        "SHA2-224A2906",
        "Safe Primes Key VerificationA2906",
        "RSA KeyGen (FIPS186-4)A2906",
        "SHA2-384A2906",
        "ECDSA SigVer (FIPS186-4)A2906",
        "Safe Primes Key GenerationA2906",
        "RSA SigVer (FIPS186-4)A2906",
        "AES-CTRA2906",
        "HMAC-SHA2-512A2906"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "10.2"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 0,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A2906",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CFB128",
            "cavpCertName": "A2906",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-CTR",
            "cavpCertName": "A2906",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256 Payload Length - Payload Length: 8-128 Increment 8 Supports Counter larger than maximum value - No Incremental Counter - No Counter Tests Performed - No",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A2906",
            "properties": "Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.1 Key Length - 128, 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A2906",
            "properties": "Prediction Resistance - No, Yes Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - No, Yes Additional Input - Additional Input: 0-384",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Increment 8 Entropy Input - Entropy Input: 256-384 Increment 8, Entropy Input: 384 Nonce - Nonce: 0, Nonce: 128 Personalization String Length - Personalization String Length: 0-384 Increment 8 Returned Bits - 512",
            "reference": ""
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - Testing Candidates",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA KeyVer (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Curve - P-256, P-384, P-521",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-224, SHA2-256, SHA2- 384, SHA2-512",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A2906",
            "properties": "MAC - MAC: 160 Key Length - Key Length: 256-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 224",
            "cavpCertName": "A2906",
            "properties": "MAC - MAC: 224 Key Length - Key Length: 256-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 256",
            "cavpCertName": "A2906",
            "properties": "MAC - MAC: 256 Key Length - Key Length: 256-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 384",
            "cavpCertName": "A2906",
            "properties": "MAC - MAC: 384 Key Length - Key Length: 256-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2- 512",
            "cavpCertName": "A2906",
            "properties": "MAC - MAC: 512 Key Length - Key Length: 256-2048 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800-56Ar3",
            "cavpCertName": "A2906",
            "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KAS-FFC-SSC Sp800-56Ar3",
            "cavpCertName": "A2906",
            "properties": "Domain Parameter Generation Methods - MODP- 2048 Scheme - dhEphem - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDF SNMP (CVL)",
            "cavpCertName": "A2906",
            "properties": "Password Length - Password Length: 64, 2048 Engine ID - 80001F88043030303030343935323630",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A2906",
            "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256, SHA2-512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF TLS (CVL)",
            "cavpCertName": "A2906",
            "properties": "TLS Version - v1.2 Hash Algorithm - SHA2-256, SHA2-384",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Key Generation Mode - B.3.6 Modulo - 2048, 3072, 4096",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "",
            "cavpCertName": "",
            "properties": "Primality Tests - Table C.2 Info Generated By Server - No Public Exponent Mode - Fixed Fixed Public Exponent - 010001 Private Key Format - Standard",
            "reference": ""
          },
          {
            "algorithm": "RSA SigGen (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-4)",
            "cavpCertName": "A2906",
            "properties": "Signature Type - PKCS 1.5, PKCSPSS Modulo - 2048, 3072, 4096",
            "reference": "FIPS 186-4"
          },
          {
            "algorithm": "Safe Primes Key Generation",
            "cavpCertName": "A2906",
            "properties": "Safe Prime Groups - MODP-2048",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "Safe Primes Key Verification",
            "cavpCertName": "A2906",
            "properties": "Safe Prime Groups - MODP-2048",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "SHA-1",
            "cavpCertName": "A2906",
            "properties": "Message Length - Message Length: 8-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-224",
            "cavpCertName": "A2906",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-256",
            "cavpCertName": "A2906",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-384",
            "cavpCertName": "A2906",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA2-512",
            "cavpCertName": "A2906",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 180-4"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "The modules support RSA public-key based authentication mechanism using a minimum of RSA 2048 bits.",
            "mechanism": "Single-Factor Cryptographic Software.",
            "name": "RSA- Based Certificate",
            "perMinute": "The probability of successfully authenticating to the module within a one minute period is 288,000,000/(2^112). The module supports at most 4,800,000 new sessions per second.",
            "strength": "With a minimum modulus size of 2048, the probability that a random attempt will"
          },
          {
            "description": "",
            "mechanism": "",
            "name": "",
            "perMinute": "",
            "strength": "succeed is 1/(2^112)."
          },
          {
            "description": "The modules support ECDSA public- key based authentication mechanism using a minimum ECDSA curve of P-256.",
            "mechanism": "Single-Factor Cryptographic Software.",
            "name": "ECDSA- Based Certificate",
            "perMinute": "The probability of successfully authenticating to the module within a one minute period is 288,000,000/(2^112). The module supports at most 4,800,000 new sessions per second.",
            "strength": "With a minimum curve of P- 256, the probability that a random attempt will succeed is 1/(2^128)."
          },
          {
            "description": "Password based authentication",
            "mechanism": "Memorized Secret (Unique Username/password).",
            "name": "Password",
            "perMinute": "The probability of successfully authenticating to the module within one minute is 10/(95^8). The firewall\u0027s configuration supports at most ten failed attempts to authenticate in a one- minute period.",
            "strength": "The minimum length is eight (8) characters (95 possible characters). The probability that a random attempt will succeed or a false acceptance will occur is 1/(958)."
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES- ECB",
            "condition": "After each power-on or via",
            "details": "Decrypt",
            "indicator": "Self-test output",
            "testMethod": "KAT",
            "testProps": "128 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Decrypt (A2906)",
            "condition": "self-test command",
            "details": "",
            "indicator": "messag e",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "AES- GCM Decrypt (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Decrypt",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES- GCM Encrypt (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Encrypt",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Counter DRBG (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "SP 800-90Arev1 Instantiate/Generate/Res eed Known Answer Tests",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA / KAS- ECC",
            "condition": "On session",
            "details": "ECDSA / KAS-ECC pairwise consistency test",
            "indicator": "System log messag es",
            "testMethod": "PCT",
            "testProps": "256 Bit Minimum",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "ECDSA SigGen (FIPS186 -4) (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Sign",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186 -4) (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Verify",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Firmware Load Test",
            "condition": "On session",
            "details": "Firmware load test on content load",
            "indicator": "System log messag es",
            "testMethod": "FW Load Test",
            "testProps": "2048 Bit",
            "type": "SW/F W Load"
          },
          {
            "algorithmOrTest": "HMAC- SHA-1 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Keyed Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "160 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2- 224 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Keyed Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "224 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2-",
            "condition": "After each power-on",
            "details": "Keyed Hash",
            "indicator": "Self-test output",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "256 (A2906)",
            "condition": "or via self-test command",
            "details": "",
            "indicator": "messag e",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "HMAC- SHA2- 384 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Keyed Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "384 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "HMAC- SHA2- 512 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Keyed Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "512 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "KAS- ECC- SSC Sp800- 56Ar3 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "KAS Computation",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Safe Primes Key Generati on (A2906)",
            "condition": "On session",
            "details": "KAS-FCC pairwise consistency test",
            "indicator": "System log messag es",
            "testMethod": "PCT",
            "testProps": "2048 Bits Minimum",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "KAS- FFC-SSC Sp800- 56Ar3 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "KAS Computation",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "2048 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA",
            "condition": "On session",
            "details": "RSA pairwise consistency test",
            "indicator": "System log messag es",
            "testMethod": "PCT",
            "testProps": "2048 Bits Minimum",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "RSA SigGen (FIPS186 -4) (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Sign",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "2048 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA SigVer (FIPS186 -4) (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Verify",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "2048 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA-1 (A2906)",
            "condition": "After each power-on or via",
            "details": "Hash",
            "indicator": "Self-test output",
            "testMethod": "KAT",
            "testProps": "160 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "",
            "condition": "self-test command",
            "details": "",
            "indicator": "messag e",
            "testMethod": "",
            "testProps": "",
            "type": ""
          },
          {
            "algorithmOrTest": "SHA2- 256 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "256 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2- 384 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "384 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA2- 512 (A2906)",
            "condition": "After each power-on or via self-test command",
            "details": "Hash",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "512 Bits",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SP 800- 90B RCT/APT Health Tests on Entropy Source",
            "condition": "After each power-on or via self-test command",
            "details": "Health tests done on entropy source",
            "indicator": "Self-test output messag e",
            "testMethod": "Fault- Detectio n",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SP 800- 135rev1 SSH KDF with SHA-256",
            "condition": "After each power-on or via self-test command",
            "details": "SSHv2 with SHA-256",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SP 800- 135rev1 TLS 1.2 with SHA-256 KDF",
            "condition": "After each power-on or via self-test command",
            "details": "TLSv1.2 with SHA-256",
            "indicator": "Self-test output messag e",
            "testMethod": "KAT",
            "testProps": "N/A",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SP 800- 56A Rev 3 Assuranc e Tests",
            "condition": "On session",
            "details": "Assurance tests for SP 800-56A Rev3",
            "indicator": "System log messag es",
            "testMethod": "Critical Functio ns",
            "testProps": "N/A",
            "type": "Critical Functio n"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "Signature verification failure",
            "description": "Signature verification fails on firmware load",
            "indicator": "System prints Invalid image message.",
            "name": "Conditional Firmware Load Test Failure",
            "recoveryMethod": "N/A"
          },
          {
            "conditions": "PCT / Critical functions test",
            "description": "Module fails a PCT or critical functions test",
            "indicator": "System log prints an error message.",
            "name": "Conditional Pairwise Consistency or Critical Functions Test Failure",
            "recoveryMethod": "Reset session"
          },
          {
            "conditions": "Self-test or Integrity Test failure",
            "description": "Module fails a self-test or integrity test",
            "indicator": "FIPS-CC mode failure. \u003cAlgorithm test\u003e failed.",
            "name": "Self-Test / Integrity Test Failure",
            "recoveryMethod": "Reboot Module or Factory Reset"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [
          {
            "inspectFreq": "30 days",
            "inspectGuidance": "(M-200, M-300) Verify integrity of tamper-evident seals in the locations identified in Section 7 of this Security Policy.",
            "mechanism": "Tamper-Evident Seals"
          },
          {
            "inspectFreq": "30 days",
            "inspectGuidance": "(M-200, M-300) Verify that opacity shields and side rails have not been loosened or deformed from their original shape, thereby reducing their effectiveness.",
            "mechanism": "Front and Rear Opacity Shields Side Rails"
          },
          {
            "inspectFreq": "30 days",
            "inspectGuidance": "(M-200, M-300) Verify top overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics.",
            "mechanism": "Top Overlays"
          },
          {
            "inspectFreq": "30 days",
            "inspectGuidance": "(M-600, M-700) Verify integrity of tamper-evident seals in the locations specified in Section 7 of this Security Policy.",
            "mechanism": "Tamper Evident Seals"
          },
          {
            "inspectFreq": "30 days",
            "inspectGuidance": "(M-600, M-700) Verify that the front and rear opacity shields have not been deformed from their original shape, thereby reducing their effectiveness",
            "mechanism": "Front and Rear Opacity Shields"
          },
          {
            "inspectFreq": "30 days",
            "inspectGuidance": "(M-600, M-700) Verify that the vent overlays have not been removed or deformed. All edges should maintain strong adhesion characteristics",
            "mechanism": "Vent Overlays"
          }
        ],
        "found": true,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [
          {
            "description": "The module has one approved mode of operation and is always in approved mode after initialization",
            "name": "Approved Mode",
            "statusIndicator": "Global indicator (\"FIPS-CC\")",
            "type": "Approved"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Module status via LED indicators",
            "logicalInterface": "Status Output",
            "physicalPort": "LED"
          },
          {
            "data": "N/A",
            "logicalInterface": "Power",
            "physicalPort": "Power"
          },
          {
            "data": "Self-test output",
            "logicalInterface": "Status Output",
            "physicalPort": "RJ45 Console"
          },
          {
            "data": "TLS, SSH",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "RJ45 Ethernet"
          },
          {
            "data": "TLS",
            "logicalInterface": "Data Input Data Output Control Input Status Output",
            "physicalPort": "SFP+ (M-600, M-700)"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "RSA-Based Certificate ECDSA-Based Certificate Password",
            "name": "Crypto Officer",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "RSA-Based Certificate ECDSA-Based Certificate Password",
            "name": "User",
            "operatorType": "User",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "2",
            "section": "1",
            "title": "General"
          },
          {
            "level": "2",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "2",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "2",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "N/A",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "2",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "2",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "2",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "3",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "N/A",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "2",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "ECDSA SigVer (FIPS186-4) (A2906)",
            "details": "Signature Verification",
            "indicator": "Self-Test successful",
            "testMethod": "KAT",
            "testProps": "P-256",
            "type": "SW/FW Integrity"
          },
          {
            "algorithmOrTest": "HMAC-SHA2-256 (A2906)",
            "details": "Keyed Checksum",
            "indicator": "Self-Test successful",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "External (outside of module\u0027s boundary )",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "Module Public Key Output",
            "sfiAlgo": "",
            "source": "HDD"
          },
          {
            "dest": "HDD",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via SSHv2 encrypted by AES and HMAC",
            "sfiAlgo": "KTS (SSHv2 with AES and HMAC)",
            "source": "External (outside of module\u0027s boundary )"
          },
          {
            "dest": "HDD",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via SSHv2 encrypted by AES-GCM",
            "sfiAlgo": "KTS (SSHv2 with AES- GCM)",
            "source": "External (outside of module\u0027s boundary )"
          },
          {
            "dest": "HDD",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via TLSv1.2 encrypted by AES and HMAC",
            "sfiAlgo": "KTS (TLSv1.2 with AES and HMAC)",
            "source": "External (outside of module\u0027s boundary )"
          },
          {
            "dest": "HDD",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Encrypte d",
            "name": "Password/Secre t Input via TLSv1.2 encrypted by AES-GCM",
            "sfiAlgo": "KTS (TLSv1.2 with AES- GCM)",
            "source": "External (outside of module\u0027s boundary )"
          },
          {
            "dest": "HDD",
            "distribution": "Automated",
            "entry": "Electroni c",
            "format": "Plaintext",
            "name": "Peer Public Key Input",
            "sfiAlgo": "",
            "source": "External (outside of module\u0027s boundary )"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Operator powers the module off or session terminates",
            "method": "Power Cycle/Session Termination",
            "operatorId": "Command via CLI or WebUI or by unplugging module",
            "rationale": "Powering off the module or terminating the session will"
          },
          {
            "description": "",
            "method": "",
            "operatorId": "",
            "rationale": "erase all SSPs stored in the RAM of the module."
          },
          {
            "description": "CO issues zeroization service",
            "method": "Zeroization Command",
            "operatorId": "Entering into maintenance mode and selecting Factory Reset",
            "rationale": "The zeroization command will erase all SSPs stored in the RAM or in the Flash of the module."
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Non-Volatile Memory",
            "name": "HDD",
            "persistance": "Static"
          },
          {
            "description": "Volatile Memory",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [
          {
            "features": "RJ45 interfaces, USB ports, LEDs",
            "fwVersion": "10.2.3-h1",
            "hwVersion": "910-000176 with 920-000208",
            "modelPartNum": "Panorama M-200",
            "processors": "Intel Xeon E5- 2620 V4"
          },
          {
            "features": "RJ45 interfaces, USB ports, LEDs",
            "fwVersion": "10.2.3-h1",
            "hwVersion": "910-000271 with 920-000319",
            "modelPartNum": "Panorama M-300",
            "processors": "Intel Xeon (Silver) 4310"
          },
          {
            "features": "RJ45 interfaces, USB ports, LEDs, SFP+ ports",
            "fwVersion": "10.2.3-h1",
            "hwVersion": "910-000175 with 920-000209",
            "modelPartNum": "Panorama M-600",
            "processors": "Intel Xeon E5- 2680 V4"
          },
          {
            "features": "RJ45 interfaces, USB ports, LEDs, SFP+ ports",
            "fwVersion": "10.2.3-h1",
            "hwVersion": "910-000270 with 920-000318",
            "modelPartNum": "Panorama M-700",
            "processors": "Intel Xeon (Silver) 4316"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [
          {
            "algoPropList": "Key Type:Asymmetric",
            "implName": "N/A",
            "name": "CKG",
            "reference": "Cryptographic Key Generation; SP 800- 133rev2 and IG D.H (symmetric keys and asymmetric seeds) from Section 4 Example 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECC": {
            "ECC": 13
          },
          "ECDH": {
            "ECDH": 9,
            "ECDHE": 2
          },
          "ECDSA": {
            "ECDSA": 112
          }
        },
        "FF": {
          "DH": {
            "DH": 3,
            "DHE": 2,
            "Diffie-Hellman": 1
          }
        },
        "RSA": {
          "RSA 2048": 11,
          "RSA 3072": 1,
          "RSA 4096": 1
        }
      },
      "certification_process": {
        "OutOfScope": {
          "in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation": 1,
          "out of scope": 1
        }
      },
      "cipher_mode": {
        "CBC": {
          "CBC": 2
        },
        "CFB": {
          "CFB": 1
        },
        "CTR": {
          "CTR": 3
        },
        "ECB": {
          "ECB": 1
        },
        "GCM": {
          "GCM": 15
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "SSH": {
          "SSH": 177,
          "SSHv2": 69
        },
        "TLS": {
          "TLS": {
            "TLS": 104,
            "TLS 1.2": 3,
            "TLSv1.2": 93
          }
        }
      },
      "crypto_scheme": {
        "KA": {
          "Key Agreement": 4
        },
        "MAC": {
          "MAC": 11
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 22,
          "P-384": 24,
          "P-521": 22
        }
      },
      "eval_facility": {},
      "fips_cert_id": {
        "Cert": {
          "#11": 2,
          "#12": 2,
          "#13": 2,
          "#14": 2,
          "#15": 2,
          "#18": 2,
          "#19": 2
        }
      },
      "fips_certlike": {
        "Certlike": {
          "- PKCS 1": 2,
          "AES (128": 1,
          "AES 128/192/256": 1,
          "AES 256": 2,
          "AES-128": 1,
          "AES-192": 1,
          "AES-256": 3,
          "HMAC- SHA-1": 1,
          "HMAC- SHA-256": 1,
          "HMAC-SHA- 160": 1,
          "HMAC-SHA- 160, 256": 1,
          "HMAC-SHA-1": 4,
          "PKCS 1": 2,
          "RSA 2048": 11,
          "RSA 3072": 1,
          "RSA 4096": 1,
          "SHA-1": 6,
          "SHA-256": 8,
          "SHA2- 224": 1,
          "SHA2- 256": 2,
          "SHA2- 384": 3,
          "SHA2- 512": 2,
          "SHA2-224": 3,
          "SHA2-256": 11,
          "SHA2-384": 4,
          "SHA2-512": 5
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 2": 1,
          "level 2": 1
        }
      },
      "hash_function": {
        "SHA": {
          "SHA1": {
            "SHA-1": 6
          },
          "SHA2": {
            "SHA-256": 8
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 54
        },
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 7,
          "FIPS 180-4": 5,
          "FIPS 186-2": 1,
          "FIPS 186-4": 8,
          "FIPS 198-1": 5,
          "FIPS18": 4,
          "FIPS186": 4,
          "FIPS186-4": 27
        },
        "NIST": {
          "SP 800-135": 3,
          "SP 800-38A": 3,
          "SP 800-38D": 1,
          "SP 800-56A": 6,
          "SP 800-90A": 1,
          "SP 800-90B": 1
        },
        "PKCS": {
          "PKCS 1": 2
        },
        "RFC": {
          "RFC 5246": 1,
          "RFC 5288": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 44,
            "AES-": 7,
            "AES-128": 1,
            "AES-192": 1,
            "AES-256": 3
          },
          "CAST": {
            "CAST": 44
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 44
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 8
        },
        "IBM": {
          "SSC": 3
        }
      },
      "tls_cipher_suite": {
        "TLS": {
          "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": 1,
          "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": 1,
          "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": 1,
          "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": 1
        }
      },
      "vendor": {},
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "HMAC-SHA2-256A2906",
        "ECDSA KeyVer (FIPS186-4)A2906",
        "AES-GCMA2906",
        "HMAC-SHA2-384A2906",
        "Counter DRBGA2906",
        "AES-CBCA2906",
        "KDF SNMPA2906",
        "ECDSA KeyGen (FIPS186-4)A2906",
        "KDF TLSA2906",
        "SHA-1A2906",
        "RSA SigGen (FIPS186-4)A2906",
        "AES-CFB128A2906",
        "ECDSA SigGen (FIPS186-4)A2906",
        "HMAC-SHA-1A2906",
        "HMAC-SHA2-224A2906",
        "SHA2-512A2906",
        "SHA2-256A2906",
        "KAS-ECC-SSC Sp800-56Ar3A2906",
        "KDF SSHA2906",
        "KAS-FFC-SSC Sp800-56Ar3A2906",
        "SHA2-224A2906",
        "Safe Primes Key VerificationA2906",
        "RSA KeyGen (FIPS186-4)A2906",
        "SHA2-384A2906",
        "ECDSA SigVer (FIPS186-4)A2906",
        "Safe Primes Key GenerationA2906",
        "RSA SigVer (FIPS186-4)A2906",
        "AES-CTRA2906",
        "HMAC-SHA2-512A2906"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A2906"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20260706103113-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20260706103113-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 1331820,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/advanced-url-filtering/advanced-url-filtering-administration.pdf",
          "https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 82
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "dd805b73a5d661e28f862ad17dbcef94e938a426318ee56b12c47e37443dc64b",
      "source_hash": "c24aefadbb3dc6cf0f98bd8b134c733d66982e231d4565f4c055041210951532",
      "txt_hash": "259b5f23deb0e0e80efe0d2a798b40571ac056a5210089e3a9d7626a1b4790c1"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and physical kit installed as indicated in the Security Policy. No assurance of minimum security of SSPs (e.g., keys, bit strings) that are externally loaded, or of SSPs established with externally loaded SSPs",
    "certificate_pdf_url": "https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/certificates/July 2026_040826_0807.pdf",
    "date_sunset": "2029-08-22",
    "description": "The Panorama 10.2 running on M-200, M-300, M-600 and M-700 from Palo Alto Networks Inc., hereafter referred to as \"Panorama M-Series\", \"Panorama HW\", \"modules\", or the \"cryptographic modules\" are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Roles, services, and authentication: Level 3",
      "Operational environment: N/A",
      "Non-invasive security: N/A",
      "Life-cycle assurance: Level 3",
      "Mitigation of other attacks: N/A"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 2,
    "mentioned_certs": {},
    "module_name": "Panorama 10.2 M-200, M-300, M-600 and M-700",
    "module_type": "Hardware",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-07-06",
        "lab": "Leidos Accredited Testing \u0026 Evaluation (AT\u0026E) Lab",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Palo Alto Networks Inc.",
    "vendor_url": "http://www.paloaltonetworks.com"
  }
}

Sections

Panorama 10.2 M-200, M-300, M-600 and M-700

Certificate details

Security policy

Extracted keywords

Symmetric Algorithms

Asymmetric Algorithms

Hash functions

Schemes

Protocols

Randomness

Elliptic Curves

Block cipher modes

TLS cipher suites

Trusted Execution Environments

Security level

Certification process

Standards

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Certificate changed

Certificate changed

Certificate changed

Certificate changed

Certificate changed

Certificate changed

Certificate changed

New certificate

Raw data

Sections

Panorama 10.2 M-200, M-300, M-600 and M-700

Certificate details

Security policy

Extracted keywords

Cryptography

Symmetric Algorithms

Asymmetric Algorithms

Hash functions

Schemes

Protocols

Randomness

Elliptic Curves

Block cipher modes

TLS cipher suites

Device

Trusted Execution Environments

Security

Security level

Certification process

Other

Standards

File metadata

Automated analysis

Automated inference - use with caution

Cross-references

Processing updates

Raw data

Toggle raw data